IT and electronic communications networks and systems play a key role in society and are now the cornerstone of economic growth. Any disruption in their operation can lead to interruptions in power and water supplies, restrictions on transport services, economic losses, and threats to public safety. The findings of the NIK audit point to recurring and significant weaknesses in cybersecurity management and oversight in the sectors examined.
None of the eight operators audited ensured that the systems used to provide the key service were resilient to actions that compromise the confidentiality, integrity, availability and authenticity of the data being processed. Furthermore, the majority of operators (six) systematically ignored critical alerts generated by monitoring and security systems, and in extreme cases did not conduct such monitoring at all, even though the scale of cyber threats was steadily increasing. Consequently, they may not even have been aware that their systems had been attacked.
In 2025, Computer Security Incident Response Teams (CSIRTs) at national level handled nearly 273,000 so-called incidents – 144.4% more than the previous year, which means that, statistically, an incident occurred in Polish cyberspace every two minutes on average. These include any event that disrupts the operation of IT systems, threatens data confidentiality or breaches information technology (IT) security policies.
Incidents affecting systems used to provide critical services are of particular significance, as their consequences may extend beyond the digital realm. A cyberattack on water supply systems, for example, allows the manipulation of water parameters. Increasing the chlorine content in the water, in turn, may endanger the health and even the lives of consumers. Hackers gaining control of electricity grids could lead to widespread and prolonged power cuts. Furthermore, as a member of the European Union and NATO, Poland faces threats from cybercriminal hacker groups or groups sponsored by foreign states.
In the face of the growing prevalence of technically sophisticated attack methods, such as malware or those using artificial intelligence (AI), maintaining and continuously improving security standards is no longer merely a technical matter. It is becoming an essential element of compliance with legal requirements and an expression of responsibility for the stability of the entire system, in which the activities of a single entity directly affect the operations of other market participants and consumers. According to the NIK, in the face of geopolitical and economic tensions, it is also crucial to identify even marginal cybersecurity threats.
NIK audited:
- the Ministry of Digital Affairs,
- the Ministry of Energy,
- the Ministry of Infrastructure,
- eight operators of essential services (from the following sectors: transport, power supply, and the supply and distribution of drinking water).
Period covered by the audit: 1 January 2021 – 16 February 2026
Malware – a general term for any form of malicious software. It is designed to cause harm to computers, mobile phones and systems. It can steal data, block access to files, destroy the system or spy on the user without their knowledge.
Ransomware – malware that encrypts files on a computer or locks the entire system. Criminals demand a ransom – usually in cryptocurrency – in exchange for a promise to restore access to the data.
Phishing attack – a scam in which a hacker impersonates a trusted company or public authority to steal someone’s passwords, money or personal data. Criminals most often use fake emails, text messages (smishing), or websites for this purpose.
A DDoS attack – an attempt to disrupt an internet service by flooding it with artificial traffic from multiple devices simultaneously. Botnets (thousands of hacked computers, cameras and routers that send requests without their owners’ knowledge) are used for this purpose.
Cybersecurity vulnerabilities – weaknesses in a system, such as code errors, misconfigurations or weak passwords, which can lead to data theft or a malicious takeover of a computer.
